About OpenVAS

OpenVAS stands for Open Vulnerability Assessment System and is a network security scanner with associated tools like a graphical user front-end. The core component is a server with a set of network vulnerability tests (NVTs) to detect security problems in remote systems and applications.

OpenVAS products are Free Software under GNU GPL and a fork of Nessus.

Status: All necessary cleanups (due to the fork from Nessus) of the OpenVAS client and server components have been completed. The current set of released modules is ready to execute scans using a secure connection between client and server. The OpenVAS NVT Feed service offers signed scripts for specific NVT families. Several NVTs inherited from Nessus are still broken because they depend on a non-free component. See also the Roadmap for further details. To be informed about OpenVAS news, you should subscribe to the announcement mailing list.

Project News

November 14th, 2008 - OpenVAS and backtrack

As OpenVAS is not in Backtrack 3 by default (yet!). You can download lzm module or download remastered backtrack3 which includes OpenVAS lzm (it still fits on 700 Mb CD). It's good way of testing OpenVAS in case you want to try it out.

October 30th, 2008 - 2008 OpenVAS Contest Winners Announced

With 5 nominees who contributed a large number of improvements to the OpenVAS framework and extended the Open Source Network Vulnerability Testing, the 2008 OpenVAS Contest was a great success.

The OpenVAS developers and the sponsors of the OpenVAS Contest would like to thank all developers for their great contributions. The developers have spent a considerable amount of time on their submissions and have helped OpenVAS to become even better. These contributions will be included in the upcoming OpenVAS 2.0 release which will help to make the task of network security scanning easier worldwide.

October 15th, 2008 - OpenVAS 2.0 Begins Public Beta Phase

In late September 2008, the OpenVAS developer team released the 2.0-beta1 version of OpenVAS, the Open Vulnerability Assessment System for network security scanning.
The intended audience for this beta release are experienced users interested in upcoming features as well as developers of vulnerability checks.

The new version introduces first steps towards support for OVAL, the Open Vulnerability and Assessment Language. OVAL is an international, information security, community standard to promote open, standardized and publicly available security content.
The OpenVAS server can now execute OVAL files just like its own Network Vulnerability Tests (NVTs) by using the OVAL definitions interpreter "ovaldi". While the plain ovaldi tool can only check local systems where it is installed, the combination with OpenVAS enables it to test any target system for which OpenVAS has collected information. The beta1 release offers sample support for Red Hat Enterprise Linux security announcements which are provided as OVAL definitions.

Major internal changes include the cleaned and extended protocol for client-server communication (OTP) and the transition to the new OID-based scheme for unique IDs of vulnerability tests. The switch from the NTP inherited from Nessus to OTP was necessary due to security and design considerations.

The OpenVAS (NVTs) remain compatible with both the 1.0 and 2.0 series of OpenVAS. This also means that the free OpenVAS NVT feed service (which has recently extended to deliver the full range of NVTs, grown to over 5000 available NVTs) is also compatible for both release series. The switch from NTP to OTP does not affect NVTs already in existance. This means NVTs written in NASL continue to be fully supported by OpenVAS. There is no need to make changes to your old NASL scripts -- unless you want to use the new features.

The first release candidate of the new OpenVAS Compendium has been made available in PDF and HTML format for final reviews and as a base for translation into other languages (a translation to German is already in progress) as well.

The OpenVAS team is looking forward to feedback for the beta1 release. If you want to participate in the beta phase by sharing your experience with beta1 or if you have any questions, please feel free to use the public mailing lists or visit us in our IRC online chat.

Contact

The best way to contact the OpenVAS development team is to subscribe to the discussions mailing list or to contact the team in our Online Chat.

The OpenVAS web site and development platform is currently operated by:
Intevation GmbH
Neuer Graben 17
49074 Osnabrück
Germany
www.intevation.de

Authorized: Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner
Registered as: HR B 18998, Amtsgericht Osnabrück
VAT ID: de 204 854 484
E-Mail: info@intevation.de
Phone: +49 541 33508-30